Privacy Information

§ 1

Responsible Party — Verantwortlicher

§ 2

Data Collected — Erhobene Daten

This website does not use advertising cookies or third-party audience analytics. Standard access data is processed by the hosting infrastructure. The Dark Hierarchy tools additionally use browser storage and, only when a visitor explicitly enables it, remote cross-device profile storage as described in § 3.

Server logs (GitHub Pages / Fastly CDN): When you visit this site, GitHub Pages automatically records standard access data including your IP address, browser type, referring URL, and timestamp. This data is processed by GitHub, Inc. (a Microsoft subsidiary) and is outside the direct control of this site's operator. Retention is governed by GitHub's own policies. For details see: GitHub Privacy Statement.

Email contact: When you contact ECHOx by email, the content of your message and any personal data it contains (name, email address, other information you choose to include) are stored for the purpose of responding and fulfilling the contractual or pre-contractual relationship. This data is stored on ProtonMail servers (Proton AG, Geneva, Switzerland), which provides end-to-end encryption and operates under Swiss and EU privacy law.

Instagram DM: Direct messages sent via Instagram are processed by Meta Platforms Ireland Ltd. under Meta's own privacy policy. ECHOx has no control over Meta's data processing.

Photography sessions: When you book a session, contact details (name, email) are retained for invoicing and communication purposes. Photographs in which you appear are processed as described in § 4 below.

§ 3

The Dark Hierarchy Interactive Tools

The tools are intended for adults and can generate profiles concerning relationships, attachment, sexuality, triggers, and personal boundaries. Depending on the answers supplied, this may include sensitive personal data within the meaning of Art. 9 DSGVO.

Local-only mode: This is the default technical state. Generated results and retrieval codes remain in the browser's local storage on the device being used. They are not transmitted to the remote profile database. Clearing browser data removes the local copy.

Optional cross-device mode: A visitor may make a separate, explicit choice to store generated results through the ECHOx profile service hosted on Cloudflare infrastructure. The stored record contains the generated tool result, its tool identifier, a random retrieval code, and consent metadata. It is used to retrieve or compare results on another device. The service does not require a name or email address for profile storage. Result statistics are not transmitted for analytics.

Legal basis: Remote profile storage is based on explicit consent under Art. 6 Abs. 1 lit. a and Art. 9 Abs. 2 lit. a DSGVO. Consent can be withdrawn for future storage at any time through the “Data choices” control in the tools. To request deletion of records already stored remotely, email the relevant retrieval codes to inbox@echoxstudios.art.

Optional email delivery: A result is sent by email only when the visitor actively enters an address and requests delivery. The address and generated email content are then processed by the profile service for transmission. They are not used for marketing.

§ 4

Legal Basis — Rechtsgrundlage

• Art. 6 Abs. 1 lit. a DSGVO — Consent: where you have made a clear, affirmative choice for a specified use.
• Art. 9 Abs. 2 lit. a DSGVO — Explicit consent: optional remote processing of sensitive results generated by The Dark Hierarchy tools.
• Art. 6 Abs. 1 lit. b DSGVO — Contractual necessity: processing required to fulfil a booking, invoice, or delivery of photographs.
• Art. 6 Abs. 1 lit. c DSGVO — Legal obligation: retention of invoicing records for up to 10 years under § 147 AO (German Tax Code).
• Art. 6 Abs. 1 lit. f DSGVO — Legitimate interest: responding to inquiries and communications.
• § 23 KUG (Kunsturhebergesetz): photographs of persons may be published without individual consent where they form part of an artistic or documentary work, subject to the limits of § 23 KUG.

§ 5

Photographs of Persons — Bildnisse

The permitted taking, delivery, publication, exhibition, and commercial use of identifiable photographs is defined in the individual booking agreement and, where applicable, a written image release. Participation in a session is not treated as blanket consent to every future use.

You may withdraw this consent at any time for future use by contacting ECHOx in writing at inbox@echoxstudios.art. Withdrawal does not affect the lawfulness of processing prior to withdrawal, and does not require the deletion of photographs already published as part of an artistic body of work where § 23 KUG applies.

§ 6

Retention Periods — Speicherdauer

• Email correspondence: retained for the duration of the business relationship and up to 3 years thereafter, unless longer retention is required by law.
• Invoicing and payment records: retained for 10 years in accordance with § 147 AO and § 257 HGB.
• Session booking information: retained for 3 years from the date of the session.
• Remote Dark Hierarchy profiles: retained while the retrieval service remains active or until deletion is requested using the associated retrieval codes.
• Local Dark Hierarchy profiles: retained only in the visitor's browser until browser storage is cleared.
• All other personal data: deleted as soon as the purpose for which it was collected has been fulfilled and no statutory retention obligation applies.

§ 7

Your Rights — Ihre Rechte

Under the DSGVO, you have the following rights regarding your personal data:

• Art. 15 DSGVO — Right of access: you may request confirmation of whether personal data concerning you is being processed and, if so, access to that data.
• Art. 16 DSGVO — Right to rectification: you may request correction of inaccurate personal data.
• Art. 17 DSGVO — Right to erasure ("right to be forgotten"): you may request deletion of personal data where it is no longer necessary or where you withdraw consent.
• Art. 18 DSGVO — Right to restriction of processing.
• Art. 20 DSGVO — Right to data portability.
• Art. 21 DSGVO — Right to object: you may object to processing based on legitimate interest at any time.
• Art. 7 Abs. 3 DSGVO — Right to withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact: inbox@echoxstudios.art

§ 8

Right to Lodge a Complaint — Beschwerderecht

You have the right to lodge a complaint with the competent data protection supervisory authority. For Berlin, this is:

§ 9

Third-Party Services

• GitHub Pages (GitHub, Inc. / Microsoft): Website hosting. May process server access logs. GitHub Privacy Statement →
• Google Fonts: This site loads fonts from Google's servers. Your IP address is transmitted to Google with each page load. Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in consistent typography). Google Privacy Policy →
• Cloudflare: Infrastructure for the optional Dark Hierarchy cross-device profile and email-delivery service. Cloudflare may process connection data and, when a visitor enables or requests those features, the submitted profile or email-delivery data. Cloudflare Privacy Policy →
• ProtonMail (Proton AG): Email provider for inbox@echoxstudios.art. End-to-end encrypted. Subject to Swiss Federal Act on Data Protection (nFADP) and GDPR. Proton Privacy Policy →
• Meta / Instagram: Instagram profile @berlinechoes is operated on Meta's platform. Meta processes data under its own privacy policy. ECHOx has no control over Meta's data processing.

§ 10

Changes to This Policy

This privacy policy may be updated to reflect changes in legal requirements or the services used. The current version is always available on this page.